6 ms·

Twitter CEO's response to employees which denies none of the claims made by CNN & WaPo* https://twitter.com/donie/status/1562069281545900033 https://twitter.co

by mzs 4y ago

Twitter CEO's response to employees which denies none of the claims made by CNN & WaPo* https://twitter.com/donie/status/1562069281545900033 https://twitter.com/donie/status/1562069281545900033 * https://www.washingtonpost.com/technology/interactive/2022/twitter-whistleblower-sec-spam/ https://www.washingtonpost.com/technology/interactive/2022/t... edit: the PDFs from * https://www.washingtonpost.com/technology/interactive/2022/twitter-whistleblower-sec-spam/current_state_assessment.pdf https://www.washingtonpost.com/technology/interactive/2022/t... https://www.washingtonpost.com/technology/interactive/2022/twitter-whistleblower-sec-spam/risk_committee_issues.pdf https://www.washingtonpost.com/technology/interactive/2022/t... https://www.washingtonpost.com/technology/interactive/2022/twitter-whistleblower-sec-spam/whistleblower_disclosure.pdf https://www.washingtonpost.com/technology/interactive/2022/t... cover letter: https://s3.documentcloud.org/documents/22161666/twitter-whistleblower-cover-letter.pdf https://s3.documentcloud.org/documents/22161666/twitter-whis... latest reaction from Capitol Hill: https://www.washingtonpost.com/technology/2022/08/23/twitter-whistleblower-congress-investigation/ https://www.washingtonpost.com/technology/2022/08/23/twitter... >Nobody at the Valley's unicorns seemed too concerned with security. (I asked Jack Dorsey that year whether he worried about the fact that hackers were continually pointing out holes in Twitter and in his new pay-ment start-up, Square. "Those guys like to whine a lot," he replied.) https://twitter.com/nicoleperlroth/status/1562048569028366337 https://twitter.com/nicoleperlroth/status/156204856902836633...

icelancer 4y ago
Agrawal's internal statement about Zatko is insane. My goodness.
- mzs 4y ago
  I know right! Was the last CEO who wasn't a monster Bill Hewlett?
systemvoltage 4y ago
Page 9/84 in the "whistleblower_disclosure.pdf" are about Elon Musk's claims of fake twitter accounts and bots. Good lord, this does not look pretty for Twitter.
- weeblewobble 4y ago
  To me that part is pretty weak compared to the security disclosures. The "lie" is about whether or not Twitter executives are incentivized to delete bots (later on he says that Twitter is incentivized to keep bots out of mDAU because they don't click on ads so they'd tank the clickthrough rate, kind of blows a whole in Elon Musk's whole thing). In reality I'm sure there are multiple overlapping and contradictory incentives at play, but it's not really a falsifiable statement so not really something you can "lie" about. The way it's framed ("Twitter lied to Elon Musk about bots") makes me suspicious of the whistleblowers' motives here. I know he's some kind of legend around these parts but I've never heard of him, so I'm just going by what I've learned today. Seems like propaganda to me, intended to maximally damage twitter and/or curry favor with Musk.
  - OMGWTF 4y ago
    It wasn't just about incentives. The disclosure also says that while Musk asked for [spam bot accounts / total active acccounts], Agrawal's response didn't really address the question and was pretty misleading [estimated spam bots among mDAU accounts / total mDAU accounts < 5%]. ("Argawal's reasoning might appear a bit circular since, by definition, mDAU is more or less Twitter's best approximation of the set of accounts that aren't bots. And Agrawal is not exactly trying to help readers understand the bait-and-switch nature of his answer." - page 13/84)
- jcranmer 4y ago
  Having skimmed that section, it hurts, not helps Musk. It's basically complaining that Twitter is prioritizing accurate, quantifiable metrics that directly impact finances over woolly, unquantifiable "platform health." Worse, executives are motivated to be honest about their metrics! He's complaining that Twitter isn't measuring what he wants it to measure, which doesn't help, because it isn't saying that Twitter is actually lying about its metrics (and, as noted, it's indirectly implying that Twitter isn't lying).
assttoasstmgr 4y ago
Thanks for posting this. Anyone commenting in this thread really needs to read the report as it paints the picture of their security hygiene. When I read things like 30% of all their endpoints have automatic updates disabled, and 40% reporting out of compliance, I'm picturing a real immature cowboy culture of arrogant developers that think they're above security policies, and no one at the helm to rope them into line. Sounds like they have no security culture, just policies. Security is something that begins with the individual.

by mzs 4y ago

icelancer 4y ago

Agrawal's internal statement about Zatko is insane. My goodness.

mzs 4y ago
I know right! Was the last CEO who wasn't a monster Bill Hewlett?

systemvoltage 4y ago

Page 9/84 in the "whistleblower_disclosure.pdf" are about Elon Musk's claims of fake twitter accounts and bots. Good lord, this does not look pretty for Twitter.

weeblewobble 4y ago
To me that part is pretty weak compared to the security disclosures. The "lie" is about whether or not Twitter executives are incentivized to delete bots (later on he says that Twitter is incentivized to keep bots out of mDAU because they don't click on ads so they'd tank the clickthrough rate, kind of blows a whole in Elon Musk's whole thing). In reality I'm sure there are multiple overlapping and contradictory incentives at play, but it's not really a falsifiable statement so not really something you can "lie" about. The way it's framed ("Twitter lied to Elon Musk about bots") makes me suspicious of the whistleblowers' motives here. I know he's some kind of legend around these parts but I've never heard of him, so I'm just going by what I've learned today. Seems like propaganda to me, intended to maximally damage twitter and/or curry favor with Musk.
- OMGWTF 4y ago
  It wasn't just about incentives. The disclosure also says that while Musk asked for [spam bot accounts / total active acccounts], Agrawal's response didn't really address the question and was pretty misleading [estimated spam bots among mDAU accounts / total mDAU accounts < 5%]. ("Argawal's reasoning might appear a bit circular since, by definition, mDAU is more or less Twitter's best approximation of the set of accounts that aren't bots. And Agrawal is not exactly trying to help readers understand the bait-and-switch nature of his answer." - page 13/84)
jcranmer 4y ago
Having skimmed that section, it hurts, not helps Musk. It's basically complaining that Twitter is prioritizing accurate, quantifiable metrics that directly impact finances over woolly, unquantifiable "platform health." Worse, executives are motivated to be honest about their metrics! He's complaining that Twitter isn't measuring what he wants it to measure, which doesn't help, because it isn't saying that Twitter is actually lying about its metrics (and, as noted, it's indirectly implying that Twitter isn't lying).

assttoasstmgr 4y ago

Thanks for posting this. Anyone commenting in this thread really needs to read the report as it paints the picture of their security hygiene. When I read things like 30% of all their endpoints have automatic updates disabled, and 40% reporting out of compliance, I'm picturing a real immature cowboy culture of arrogant developers that think they're above security policies, and no one at the helm to rope them into line. Sounds like they have no security culture, just policies. Security is something that begins with the individual.